The app keeps its session in an HttpOnly cookie, so JavaScript can't read it. An attacker finds an XSS bug. What can the attacker still do?

HttpOnly stops the attacker from stealing the cookie and using it later from their own machine. But while their script runs in your page, it can call fetch on your API. The browser adds the cookie, and the script can read the responses. So it can change the email address, read private data or make purchases. The same is true for tokens kept in memory, because the script can call the API or hook your fetch.

"HttpOnly makes XSS harmless" is the tempting wrong answer. HttpOnly limits how long the damage lasts. Preventing XSS (escaping, sanitizing, CSP) is still the main defence. "Only read the cookie with document.cookie" is wrong, because HttpOnly blocks exactly that.